tomcat vulnerabilities (Rocky Linux)
43 vulnerabilities.
-
tomcatRocky Linux Apache Tomcat: Principal lookup can fail open in some cases 8.1 High -
tomcatRocky Linux Apache Tomcat: DoS via allocation leak in HTTP/2 backlog tracking when a stream is reset 7.5 High -
tomcatRocky Linux Apache Tomcat: Redirect after FORM auth may bypass method specific constraints 9.1 Critical -
tomcatRocky Linux Apache Tomcat: RewriteValve [N] restarts at the second rule and may bypass access control 7.5 High -
tomcatRocky Linux Apache Tomcat: Limited replay attack possible with DIGEST authentication 9.8 Critical -
tomcatRocky Linux Apache Tomcat: HTTP/2 no-authority bypass of strict SNI validation - CVE-2026-32990 fix incomplete 9.8 Critical -
tomcatRocky Linux Apache Tomcat: Bypass longest prefix security constraint 9.1 Critical -
tomcatRocky Linux Apache Tomcat: EncryptInterceptor requirements not clearly documented 9.1 Critical -
tomcatRocky Linux Apache Tomcat: Incorrect URL decoding in RewriteValve may allow security control bypass 9.1 Critical -
tomcatRocky Linux Apache Tomcat: Authentication bypass with JNDIRealm and GSSAPI authenticated bind 7.3 High -
tomcatRocky Linux Apache Tomcat: Security constraints not correctly applied 9.1 Critical -
tomcatRocky Linux Apache Tomcat: LockOutRealm treats user names as case-sensitive 7.5 High -
tomcatRocky Linux Apache Tomcat: Digest authenticator will authenticate any unknown user 9.8 Critical -
tomcatRocky Linux Apache Tomcat: HTTP/2 request headers not validated 9.8 Critical -
tomcatRocky Linux Apache Tomcat: WebSocket authentication header exposure 7.3 High -
tomcatRocky Linux Apache Tomcat: Fix for CVE-2026-29146 allowed bypass of EncryptInterceptor 7.5 High -
tomcatRocky Linux Apache Tomcat: Fix for CVE-2025-66614 is incomplete 5.3 Medium -
tomcatRocky Linux Apache Tomcat: EncryptInterceptor vulnerable to padding oracle attack by default 7.5 High -
tomcatRocky Linux Apache Tomcat Native, Apache Tomcat: OCSP revocation bypass 7.5 High -
tomcatRocky Linux Apache Tomcat: Delayed cleaning of multi-part upload temporary files may lead to DoS 5.3 Medium -
tomcatRocky Linux Apache Tomcat: Directory traversal via rewrite with possible RCE if PUT is enabled 7.5 High -
tomcatRocky Linux Apache Tomcat: console manipulation via escape sequences in log messages 9.6 Critical -
tomcatRocky Linux Apache Tomcat: session fixation via rewrite valve 6.5 Medium -
tomcatRocky Linux Apache Tomcat: h2 DoS - Made You Reset 7.5 High -
tomcatRocky Linux Apache Tomcat: DoS via excessive h2 streams at connection start 7.5 High -
tomcatRocky Linux Apache Tomcat: DoS via integer overflow in multipart file upload 7.5 High -
tomcatRocky Linux Apache Tomcat: APR/Native Connector crash leading to DoS 7.5 High -
tomcatRocky Linux Apache Commons FileUpload, Apache Commons FileUpload: FileUpload DoS via part headers 7.5 High -
tomcatRocky Linux Apache Tomcat: Security constraint bypass for pre/post-resources 7.5 High -
tomcatRocky Linux Apache Tomcat: FileUpload large number of parts with headers DoS 7.5 High -
tomcatRocky Linux Apache Tomcat: Security constraint bypass for CGI scripts 7.3 High -
tomcatRocky Linux Apache Tomcat: Bypass of rules in Rewrite Valve 9.8 Critical -
tomcatRocky Linux Apache Tomcat: DoS via malformed HTTP/2 PRIORITY_UPDATE frame 7.5 High -
tomcatRocky Linux Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT 9.8 Critical -
tomcatRocky Linux Apache Tomcat: RCE due to TOCTOU issue in JSP compilation - CVE-2024-50379 mitigation was incomplete 9.8 Critical -
tomcatRocky Linux Apache Tomcat: DoS in examples web application 5.3 Medium -
tomcatRocky Linux Apache Tomcat: RCE due to TOCTOU issue in JSP compilation 9.8 Critical -
tomcatRocky Linux Apache Tomcat: Authentication bypass when using Jakarta Authentication API 9.8 Critical -
tomcatRocky Linux Apache Tomcat: HTTP/2 excess header handling DoS 7.5 High -
tomcatRocky Linux Apache Tomcat: WebSocket DoS with incomplete closing handshake 6.3 Medium -
tomcatRocky Linux Apache Tomcat: HTTP/2 header handling DoS 7.5 High -
tomcatRocky Linux Apache Tomcat: HTTP request smuggling via malformed trailer headers 7.5 High -
tomcatRocky Linux Eclipse Jetty XmlParser allows arbitrary DOCTYPE declarations 7.5 High